1. Field of the Invention
The present invention relates to the protection of an integrated circuit chip against laser attacks. It more specifically aims at the detection of the thinning down of the chip substrate which is carried out before performing a laser attack.
2. Discussion of the Related Art
FIG. 1 is a simplified cross-section view of an integrated circuit chip 1 comprising a semiconductor support substrate 3, comprising in its upper portion an active layer 5 in which are formed electronic components, not shown. Substrate 3 is currently covered with a stack of insulating layers 7. Conductive interconnection tracks 9 are formed between insulating layers. There generally exist several successive interconnection levels, for example, three, M1 to M3, in the shown example. Conductive vias, not shown, cross the insulating layers to connect the conductive tracks to one another, to input-output terminals 11 of the chip, and to components of active area 5, thus forming the circuit interconnects.
In secure devices, for example, payment cards, some regions of active area 5 are capable of processing and/or storing critical data, for example, ciphering keys. Such devices may be subject to fraudulent manipulations aiming at obtaining protected confidential data.
Among known attacks, so-called “fault attacks” comprise deliberately disturbing the operation of a chip, and analyzing the effect of the disturbances on its behavior. The attacker is especially interested in the influence of disturbances on data such as output signals, power consumption, or response times. He is likely to deduce therefrom, by statistical studies or others, critical data such as the algorithms used and possibly the ciphering keys. To deliberately cause faults in the circuits of a chip, an attack mode comprises bombarding areas of the chip with a laser beam. It is thus possible to inject faults into certain memory cells and/or to alter the operation of certain components. It should be noted that in a laser attack, the chip should be powered.
FIG. 2 is a simplified cross-section view of chip 1 of FIG. 1 illustrating a preliminary step where substrate 3 is thinned down, which is necessary to carry out a laser attack. To make the components of active region 5 accessible to the laser beam, the attacker needs to remove part of the thickness of support substrate 3. As an example, a chip formed from a substrate having a 180-μm thickness will have its thickness decreased by on the order of 150 μm before a laser attack.
To ensure protection against tampering, an attack detection device coupled to a protection circuit is generally provided in secure chips. When an attack is detected, the protection circuit implements measures of protection, alienation, or destruction of the critical data. For example, it may be provided, when an attack is detected, to interrupt the power supply of the chip or to reset it, in order to reduce the time for which the attacker can study the chip response to a disturbance.
Attack detection solutions may be logical. They, for example, comprise regularly introducing into the calculations integrity tests enabling to make sure that the data have not been modified from the outside. Such solutions have the disadvantage of introducing additional calculation steps, thus increasing the chip response times. Further, integrity tests cannot detect all the disturbances caused by an attacker. The latter thus has a leeway likely to enable him to acquire critical data.
Other so-called physical attack detection solutions especially comprise sensors sensitive to temperature variations, to ultraviolet rays, or to X rays, enabling to detect suspicious activities. Like logic solutions, such solutions are not perfectly reliable. Indeed, the attacker has a leeway before the attack has been detected, during which he may be able to obtain critical data. Further, such solutions are expensive and difficult to implement.